All you'd have to do is grab a PAT from a terminated employee's workstation and you'd have access to anything they did, in their name, until it expires.
Another good reason why you shouldn't use company property for personal stuff, especially not for union organizing activities.
That would be stealing credentials, they were arguing they might have obtained them legitimately.
I, too, would argue I obtained them legitimately, by giving Claude access to the filesystem image and asking it questions it could only answer by doing exactly this.